CISM Practice Test 20 — 15 Questions

Question 1

During an incident, the response team collects volatile data from a compromised server. Which of the following should be collected FIRST to minimize loss of evidence?

Accepted Answer

Contents of RAM. Volatile data, such as the contents of RAM, is lost when a system is powered off. The first priority during incident response is to capture this data because it contains running processes, network connections, encryption keys, and malware that exist only in memory. Collecting RAM first ensures that this critical evidence is preserved before any other actions that might alter the system state.

Answer

Contents of hard drive

Answer

Event logs

Answer

Network configuration

Question 2

A company is considering outsourcing its security operations center (SOC). Which governance consideration is MOST critical before finalizing the decision?

Accepted Answer

The ability to maintain oversight and accountability for security outcomes.. Governance requires that the organization retains ultimate responsibility for security outcomes, even when functions are outsourced. Without the ability to maintain oversight and accountability, the company cannot ensure that its security posture aligns with business risk tolerance and regulatory compliance requirements. This is a fundamental principle of information security governance, as the board and senior management cannot delegate accountability.

Answer

The vendor's service level agreements (SLAs) for incident response times.

Answer

The vendor's technical expertise and certifications.

Answer

The cost savings compared to in-house operations.

Question 3

Which incident category typically involves an employee intentionally or accidentally causing harm to the organization's information systems?

Accepted Answer

Insider threat. An insider threat is the correct category because it specifically involves harm caused by individuals within the organization, whether through malicious intent (e.g., data exfiltration, sabotage) or accidental actions (e.g., misconfiguration, phishing click). This aligns with the CISM definition of insider threats as incidents originating from employees, contractors, or trusted partners who have authorized access to information systems.

Answer

Data breach

Answer

DDoS

Answer

Ransomware

Question 4

A SOC analyst receives an alert about a potential malware infection on a critical server. Which step should the analyst take FIRST?

Accepted Answer

Perform initial triage to verify the alert and assess severity. The first step in any incident response is to verify that an alert represents a real incident and assess its severity. Performing initial triage allows the analyst to gather evidence, determine the scope, and decide on the appropriate response without causing unnecessary disruption. Rebooting, disconnecting, or escalating prematurely can destroy evidence or disrupt critical services.

Answer

Reboot the server to clear the potential malware

Answer

Notify the incident response team and escalate

Answer

Disconnect the server from the network immediately

Question 5

Which of the following is the PRIMARY purpose of conducting a lessons learned meeting after an incident?

Accepted Answer

To update the incident response plan and playbooks based on findings.. Lessons learned meetings are designed to identify strengths and weaknesses in the incident response process and to implement improvements.

Answer

To assign blame for the incident.

Answer

To determine the financial impact of the incident.

Answer

To document the incident for regulatory reporting.

Question 6

The security team is designing a security awareness program. Which topic should be prioritized FIRST?

Accepted Answer

Phishing recognition and reporting. Phishing remains the leading initial access vector in real-world breaches, and humans are the primary target. A security awareness program should prioritize phishing recognition and reporting because it directly addresses the most exploited attack surface and produces measurable reductions in successful compromises. Teaching users to spot and report suspicious emails creates a human sensor network that feeds the SOC with early threat intelligence.

Answer

Password creation and management

Answer

Incident reporting procedures

Answer

Data classification and handling

Question 7

The following incident response configuration is set:
```
playbook: standard
actions:
  - notify: incident_response_team
  - auto_containment: true
priority_override: false
```
Based on the configuration snippet, what is the expected behavior when an incident is triggered?

Accepted Answer

Standard playbook executed, notification sent, auto containment applied.. The configuration specifies the standard playbook, a notify action targeting the incident response team, and auto_containment set to true, so all three behaviors execute when an incident triggers. The priority_override flag is false, meaning no priority override is applied — but that does not suppress the other configured actions. Therefore the standard playbook runs, the team is notified, and containment is applied automatically.

Answer

The incident is logged but no action is taken.

Answer

Priority override applied, but no notification sent.

Answer

Auto containment applied without executing any playbook.

Question 8

An analyst receives an alert indicating a potential data exfiltration. The alert shows a host IP address 10.10.50.200 sending large amounts of data to an external IP address 203.0.113.5 over port 443. What should the analyst do FIRST?

Accepted Answer

Verify the alert by checking logs and network traffic. The first step in incident response is to validate the alert. The analyst must verify that the traffic is indeed anomalous and not legitimate (e.g., a large backup or software update) by examining logs and packet captures. Premature action without verification could disrupt business operations or destroy forensic evidence.

Answer

Block the external IP address immediately

Answer

Escalate to the incident response team

Answer

Isolate the host from the network

Question 9

A security manager is presenting risk analysis results to the board. Which of the following should the manager include to effectively communicate risk? (Select THREE)

Accepted Answer

Monetary value of potential losses. Monetary value of potential losses (A) is correct because it translates technical risk into financial terms that board members understand, enabling informed decisions on resource allocation for risk mitigation. This aligns with the CISM focus on business-aligned risk communication, where quantitative metrics like Annualized Loss Expectancy (ALE) directly support cost-benefit analysis.

Answer

Detailed technical vulnerabilities

Answer

Anecdotal stories of past incidents

Question 10

Which of the following best describes the role of the chief information security officer (CISO) in a governance context?

Accepted Answer

The CISO oversees the security program and reports to executive leadership. The CISO oversees the security program and reports to executive leadership, such as the CEO or CIO, to ensure that security risks are managed and aligned with business goals. This role involves strategic planning, policy development, and coordination across the organization. The CISO is not a board member with voting rights but may present to the board or its committees.

Answer

The CISO delegates all strategic decisions to the CIO

Answer

The CISO is a peer to the board with voting rights

Answer

The CISO is primarily a technical role focused on firewall management

Question 11

An organization has just experienced a ransomware attack that encrypted files on several file servers. The incident response team has contained the incident. What is the next critical step?

Accepted Answer

Restore files from clean backups.. Restore files from clean backups, as this is the most reliable recovery method after containment. Paying the ransom is discouraged and does not guarantee data recovery; notifying law enforcement can be done later; wiping and reimaging may be unnecessary if clean backups are available.

Answer

Pay the ransom to recover data.

Answer

Wipe the affected servers and reimage them.

Answer

Notify law enforcement.

Question 12

An organization suspects a data breach. Which two actions should the incident response team take before notifying affected customers? (Choose two.)

Accepted Answer

Confirm that the breach actually occurred.. The incident response team must first confirm that a breach actually occurred before taking any further action, including notification. Premature notification without confirmation can lead to false alarms, legal liability, and reputational damage. Confirmation involves verifying indicators of compromise (IoCs) through log analysis, forensic evidence, and chain-of-custody procedures.

Answer

Determine the root cause of the breach.

Answer

Implement full remediation.

Answer

Consult with legal counsel regarding notification obligations.

Question 13

Which of the following is the PRIMARY purpose of a security champions program?

Accepted Answer

Embed security advocates in dev teams to promote secure practices. The primary purpose of a security champions program is to embed security advocates within development teams to promote secure practices and foster a security culture. Champions are developers who receive additional security training and act as the go-to person for security questions within their team, helping to integrate security earlier in the SDLC. This scales security knowledge without adding dedicated security staff to every team.

Answer

Enforce compliance with security policies

Answer

Reduce the number of phishing simulations

Answer

Replace the need for a dedicated security team

Question 14

Arrange the steps for performing a vulnerability scan on a network segment.

Accepted Answer

Obtain authorization, configure scan parameters, execute scan, analyze results, prioritize findings. Vulnerability scanning requires authorization, configuration, execution, analysis, and prioritization.

Answer

Configure scan parameters, obtain authorization, execute scan, analyze results, prioritize findings

Answer

Obtain authorization, execute scan, configure scan parameters, analyze results, prioritize findings

Answer

Obtain authorization, configure scan parameters, analyze results, execute scan, prioritize findings

Question 15

Which TWO of the following are appropriate actions for preserving evidence during a cybersecurity incident?

Accepted Answer

Create forensic bit-for-bit images of affected systems. Option B is correct because creating a forensic bit-for-bit image preserves an exact, verifiable copy of the affected system's storage, including slack space and deleted-file remnants, so analysis can be performed on the copy without altering the original evidence. Option C is correct because a legal hold formally suspends normal data-retention and deletion practices, ensuring that logs, emails, and other potentially relevant records are not destroyed and remain admissible. Option A is wrong because rebooting destroys volatile memory (RAM, cache, running processes) rather than capturing it; live memory acquisition must be done before any shutdown. Option D is wrong as a blanket evidence-preservation step because pulling the plug can destroy volatile evidence and is a containment action, not a forensic preservation action. Option E is wrong because deleting temporary files spoliates potential evidence and violates the duty to preserve relevant data.

Answer

Reboot systems to capture volatile memory

Answer

Disconnect affected systems from the network immediately

Answer

Delete temporary files to free up space